Adding user with restrictions

[Steve Ferrara]

How do you restrict a user to accessing your server strictly via ftp? Also, how do you restrict them to use one specific directory?

Thanks

[Uday_S_Ankolekar · Accepted solution]

Create user id with shell as /usr/bin/ftp and add /usr/bin/ftp to /etc/shells.
You can restrict to a perticular directory by mentioning PATH=/restrictedDIR in .profile file of user's home directory and change ownership of the .profile to root:bin

-USA..

[Sanjay_6]

Hi,

To restrict the user to have only ftp access, ley the login shell for the user be set as /usr/bin/false and add this in the /etc/shells file. Also you can setup ftpaccess to set restrictions for the user.

http://www1.itrc.hp.com/service/cki/docDisplay.do?docLocale=en_US&docId=200000073346999

The itrc doc id is BC0814KBRC00007719.

Hope this helps.

Regds

[Mel Burslan]

let's assume the username who will only have ftp access and nothing else is 'ftpuser'

useradd -m -s /usr/bin/false

edit password file using 'vipw' command and change the home directory of the user to /home/ftpuser/./ ,i.e., add a /./ at the end of whatever is already there

add /usr/bin/false to /etc/shells if it is not there already

if exists edit /etc/ftpd/ftpaccess file and add these lines :

class all ftpuser,guest *
guestgroup none

chmod 444 /etc/ftpd/ftpaccess
chown bin:bin /etc/ftpd/ftpaccess

vi /etc/inetd.conf

find the line beginning with ftp and if is not there already add "-a" without the quotes of course to the end. It should look like this :

ftp stream tcp nowait root /usr/lbin/ftpd ftpd -l -a

/usr/sbin/inetd -k
/usr/sbin/inetd -l
(which restarts inetd with the newly changed settings if you changed anything)

mkdir ~ftpuser/usr
mkdir ~ftpuser/usr/bin
chown bin:bin ~ftpuser/usr
chmod 555 ~ftpuser/usr
chown root:bin ~ftpuser/usr/bin
chmod 555 ~ftpuser/usr/bin
cp -p /sbin/ls ~ftpuser/usr/bin/ls

hope this helps

[Mel Burslan]

oh, I realized that I made a typo on the user add line. it should have read:

useradd -m -s /usr/bin/false ftpuser

(must find coffeee...)